iptablesの書き方を間違えて怒られた時の原因集

生半可なく書き間違えて、失敗しても猛スピードで忘れるので記録していく。

# 事象 : Applying firewall rules: iptables-restore
```bash
$ sudo service iptables restart
iptables: Setting chains to policy ACCEPT: nat             [  OK  ]
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Unloading modules:                               [  OK  ]
iptables: Applying firewall rules: iptables-restore: line 9 failed
                                                           [FAILED]
```
## 原因 : パケット転送の設定を`*nat`じゃなくて`*filter`に書いてしまった
- 環境
    - CentOS release 6.9 (Final)
    - iptables v1.4.7

```bash
$ sudo cat /etc/sysconfig/iptables
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -p tcp -m tcp --dport 10080 -j DNAT --to-destination 10.0.1.2:80
-A POSTROUTING -d 10.0.1.2/32 -p tcp -m tcp --dport 80 -j SNAT --to-source 10.0.1.3
...省略...
```
- 対応 : パケット転送の設定を*natに書く


# 事象 : Applying firewall rules: iptables-restore v1.x.x: Can’t set policy `INPUT' on `ACCEPT'
```bash
$ sudo service iptables restart
iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Unloading modules:                               [  OK  ]
iptables: Applying firewall rules: iptables-restore v1.4.7: Can’t set policy `INPUT' on `ACCEPT' line 5: Bad built-in chain name
                                                           [FAILED]
```
## 原因1 : `INPUT`が`*nat`に書いてあるから
- 環境
    - CentOS release 6.9 (Final)
    - iptables v1.4.7

```bash:INPUTはfilterとmagnleに設定するもの
$ sudo cat /etc/sysconfig/iptables
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
...省略...
```
- 対応 : 「:INPUT ACCEPT [0:0]」を削除する


# 事象 : Applying firewall rules: Bad argument

```bash
$ sudo service iptables restart
iptables: Setting chains to policy ACCEPT: nat             [  OK  ]
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Unloading modules:                               [  OK  ]
iptables: Applying firewall rules: Bad argument `*filter'
Error occurred at line: 10
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
                                                           [FAILED]
```
## 原因1 : 「COMMIT」を書いていないから
- 環境
    - CentOS release 6.9 (Final)
    - iptables v1.4.7

```bash
$ sudo cat /etc/sysconfig/iptables
*nat
...省略...
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
```
- 対応 : *filterの最後に「COMMIT」を追記する


# 事象 : Applying firewall rules: iptables-restore v1.4.18: invalid port/service `68081' specified
- 環境
    - Amazon Linux AMI release 2017.09
    - iptables v1.4.18

```bash
$ sudo service iptables restart
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Setting chains to policy ACCEPT: filter nat      [  OK  ]
iptables: Unloading modules:                               [  OK  ]
iptables: Applying firewall rules: iptables-restore v1.4.18: invalid port/service `68081' specified
Error occurred at line: 57
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
                                                           [FAILED]
```
## 原因 : ポート番号の枠(～65535)を超えたから？
> ポート番号の枠は 0 ～ 65535 ですが、ポート番号には以下の3つの種類があります。
> [TCP/UDPポート番号一覧](https://www.infraexpert.com/study/tea5.htm)

既存の設定と被らないようにどんどんポート番号をでかくしてしまった・・・。

```bash
$ sudo cat /etc/sysconfig/iptables | grep 68081
-A PREROUTING -p tcp -m tcp --dport 68081 -j DNAT --to-destination 10.0.0.221:8081
```

> Port numbers are assigned in various ways, based on three ranges: System Ports (0-1023), User Ports (1024-49151), and the Dynamic and/or Private Ports (49152-65535); the difference uses of these ranges is described in [RFC6335]. 
> [Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?skey=-2)

- 対応 : 65535以下のポート番号に変更する